# CVE-2026-95833: itsourcecode Leave Management System SQL injection in /module/leavetype

Source: https://junglewise.ai/threats/cve-2026-95833-a-weakness-has-been-identified-in-itsourcecode-leave-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95833 · Severity: medium · CVSS 6.3 · Published 2026-09-23

itsourcecode Leave Management System is a web-based application for managing employee leave requests. An attacker can manipulate the 'id' parameter in the leave type editor to inject malicious SQL commands, allowing unauthorized access to the database, theft of sensitive personnel data, and modification or deletion of leave records. The vulnerability requires valid login credentials but poses a serious risk to organizational data integrity and employee privacy.

Technologies: [Itsourcecode Leave Management System](https://junglewise.ai/threats/technologies/itsourcecode-leave-management-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-95833 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95833 being exploited in the wild.

**How severe is CVE-2026-95833?** Medium severity, with a CVSS score of 6.3, published 23 September 2026.

**Which products and versions are affected?** Itsourcecode Leave Management System 1.0.

**Is there a fix for CVE-2026-95833?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-95833 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-95833?** Check whether you run Itsourcecode Leave Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in /module/leavetype/index.php where the 'id' parameter is not properly sanitized before inclusion in SQL queries. An authenticated attacker can craft malicious SQL payloads via the 'id' GET parameter to extract, modify, or delete database records. The vulnerability allows escalation from authenticated user to database-level compromise through time-based or error-based SQL injection techniques.

## Affected products

- itsourcecode Leave Management System 1.0

## Timeline

- 2026-08-29: disclosed
- 2026-09-23: advisory

## References

- [https://github.com/ltranquility/submit_repository/issues/16](https://github.com/ltranquility/submit_repository/issues/16)
- [https://itsourcecode.com/](https://itsourcecode.com/)

## Related threats

- [itsourcecode Leave Management System SQL injection](https://junglewise.ai/threats/cve-2026-103690-a-flaw-has-been-found-in-itsourcecode-leave-management-system-1)
- [itsourcecode Leave Management System SQL injection](https://junglewise.ai/threats/cve-2026-103543-a-vulnerability-has-been-found-in-itsourcecode-leave-management)
- [itsourcecode Leave Management System SQL injection](https://junglewise.ai/threats/cve-2026-94032-a-flaw-has-been-found-in-itsourcecode-leave-management-system-1-0)
- [itsourcecode Leave Management System SQL injection in department module](https://junglewise.ai/threats/cve-2026-93963-a-security-vulnerability-has-been-detected-in-itsourcecode-leave)